rage.fail

gcp-sr-trigger-refs-repo

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "triggerTemplate.repoName", "resource_type": "google.cloudbuild.Trigger" }

where

triggerTemplate.repoName is set (1st-gen CSR-backed trigger)

emit

source type	`*`
target type	`ArtifactRepository`
source	`<Cloud Build Trigger (EventRule)>`
target	`<CSR repository named by triggerTemplate.repoName>`

Narrative

Cloud Build trigger {trigger.name} watches CSR repository {repo.name}; a push to the target branch arms this trigger.

Raw rule rules/explicit/gcp-sourcerepos.yaml

id: gcp-sr-trigger-refs-repo
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type: google.cloudbuild.Trigger
  field: triggerTemplate.repoName
where:
- triggerTemplate.repoName is set (1st-gen CSR-backed trigger)
emit:
  source_type: '*'
  target_type: ArtifactRepository
  source: <Cloud Build Trigger (EventRule)>
  target: <CSR repository named by triggerTemplate.repoName>
  api_source: cloudbuild.projects.triggers.list
  evidence_field: triggerTemplate.repoName
  narrative: Cloud Build trigger {trigger.name} watches CSR repository {repo.name}; a push to the target
    branch arms this trigger.